Executive brief
A vulnerability in a common guestbook web application allows unauthorized individuals to run commands on the web server. This could lead to a complete takeover of the website, theft of sensitive data, or disruption of services. The issue affects older web environments that utilize the Guestbook CGI script for visitor comments.
Technical details
The Guestbook CGI program contains a vulnerability that allows for remote command execution. This typically occurs due to insufficient sanitization of user-supplied input before it is passed to a shell or system call within the Perl-based CGI script. An unauthenticated remote attacker can exploit this by sending specially crafted HTTP requests containing shell metacharacters. Successful exploitation grants the attacker the ability to execute arbitrary commands with the privileges of the web server process. This is a classic input validation flaw common in early CGI scripts.
Affected products
- Matt Wright Guestbook CGI
Timeline
- 1997-09-01: disclosed: Initial publication date in NVD